github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-07-01 12:42:02 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
44,345 Commits 337 Branches 518 Tags
dd6ec65061e747442f3d2ab0eb60764e88eff2d8
Commit Graph

3 Commits

Author SHA1 Message Date
Roman Rizzi
df3eb93973 DEV: Sanitize HTML admin inputs (#14681) 
* DEV: Sanitize HTML admin inputs

This PR adds on-save HTML sanitization for:

Client site settings
translation overrides
badges descriptions
user fields descriptions

I used Rails's SafeListSanitizer, which [accepts the following HTML tags and attributes](018cf54073/lib/rails/html/sanitizer.rb (L108))

* Make sure that the sanitization logic doesn't corrupt settings with special characters
 2021-10-27 11:33:07 -03:00
Sam Saffron
4ea21fa2d0 DEV: use #frozen_string_literal: true on all spec 
This change both speeds up specs (less strings to allocate) and helps catch
cases where methods in Discourse are mutating inputs.

Overall we will be migrating everything to use #frozen_string_literal: true
it will take a while, but this is the first and safest move in this direction
 2019-04-30 10:27:42 +10:00
Maja Komel
65f3ed0689 UX: make name optional for confirmation user field (#7149) 2019-03-13 18:40:43 +01:00